{"record":{"id":"2115756e001e8f75","repo":"golang/go","slug":"cipher-the-nonce-can-t-have-zero-length-211575","errorCode":null,"errorMessage":"cipher: the nonce can't have zero length","messagePattern":"cipher: the nonce can't have zero length","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"src/crypto/internal/fips140/aes/gcm/gcm.go","lineNumber":36,"sourceCode":"\ttagSize   int\n\tgcmPlatformData\n}\n\nfunc New(cipher *aes.Block, nonceSize, tagSize int) (*GCM, error) {\n\t// This function is outlined to let the allocation happen on the parent stack.\n\treturn newGCM(&GCM{}, cipher, nonceSize, tagSize)\n}\n\n// newGCM is marked go:noinline to avoid it inlining into New, and making New\n// too complex to inline itself.\n//\n//go:noinline\nfunc newGCM(g *GCM, cipher *aes.Block, nonceSize, tagSize int) (*GCM, error) {\n\tif tagSize < gcmMinimumTagSize || tagSize > gcmBlockSize {\n\t\treturn nil, errors.New(\"cipher: incorrect tag size given to GCM\")\n\t}\n\tif nonceSize <= 0 {\n\t\treturn nil, errors.New(\"cipher: the nonce can't have zero length\")\n\t}\n\tif cipher.BlockSize() != gcmBlockSize {\n\t\treturn nil, errors.New(\"cipher: NewGCM requires 128-bit block cipher\")\n\t}\n\tg.cipher = *cipher\n\tg.nonceSize = nonceSize\n\tg.tagSize = tagSize\n\tinitGCM(g)\n\treturn g, nil\n}\n\nconst (\n\tgcmBlockSize         = 16\n\tgcmTagSize           = 16\n\tgcmMinimumTagSize    = 12 // NIST SP 800-38D recommends tags with 12 or more bytes.\n\tgcmStandardNonceSize = 12\n)\n","sourceCodeStart":18,"sourceCodeEnd":54,"githubUrl":"https://github.com/golang/go/blob/b6b368adc57c96c3151d224d172029f233ead2c3/src/crypto/internal/fips140/aes/gcm/gcm.go#L18-L54","documentation":"Returned by gcm.New when nonceSize <= 0. GCM requires a positive nonce length; the standard nonce is 12 bytes but the API allows other lengths (via a slower path), except zero. Surfaces through cipher.NewGCMWithNonceSize or cipher.NewGCM(..., WithNonceSize(n)).","triggerScenarios":"Calling cipher.NewGCM(block, cipher.WithNonceSize(n)) or gcm.New(block, n, tagSize) with n <= 0.","commonSituations":"Passing nonceSize=0 from an uninitialized/config-derived value; computing nonce size from a length-of-empty slice; misreading the standard 12-byte default.","solutions":["Use the standard 12-byte nonce unless you have a specific reason to change it.","If omitted, omit the option entirely so gcmStandardNonceSize (12) applies.","Validate nonceSize > 0 before constructing the AEAD."],"exampleFix":"// before\naead, err := cipher.NewGCM(block, cipher.WithNonceSize(0))\n// after\naead, err := cipher.NewGCM(block) // default 12-byte nonce\n// or explicit:\naead, err := cipher.NewGCM(block, cipher.WithNonceSize(12))","handlingStrategy":"validation","validationCode":"func validGCMNonceSize(n int) bool { return n > 0 }\n\nif !validGCMNonceSize(nonceSize) { return errors.New(\"nonce size must be > 0\") }\naead, err := cipher.NewGCM(block, cipher.WithNonceSize(nonceSize))","typeGuard":"// n/a: int parameter; guard with range check.","tryCatchPattern":"aead, err := cipher.NewGCM(block, cipher.WithNonceSize(nonceSize))\nif err != nil { return fmt.Errorf(\"gcm init: %w\", err) }","preventionTips":["Default to the 12-byte nonce.","Validate user-supplied nonce sizes.","Never derive nonceSize from len(emptySlice)."],"tags":["crypto","aes","gcm","cipher","fips","validation"],"backgroundTag":null,"analyzedSha":"b6b368adc57c96c3151d224d172029f233ead2c3","analyzedAt":"2026-08-12T00:22:02.250Z","schemaVersion":2},"datasetVersion":"2026-08-12T13:17:24.610Z"}